# Vulnerability / security issue with Dolibarr Debian installer and conf.php

**URL:** <https://www.dolibarr.org/forum/t/vulnerability-security-issue-with-dolibarr-debian-installer-and-conf-php/24561>\
**Category:** Installing my Dolibarr\
**Tags:** Debian, Issue, Linux\
**Created:** [November 16, 2023, 9:45am UTC](https://www.dolibarr.org/forum/t/vulnerability-security-issue-with-dolibarr-debian-installer-and-conf-php/24561 "2023-11-16T09:45:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![intern23](https://www.dolibarr.org/forum/letter_avatar_proxy/v4/letter/i/958977/32.png) [@intern23](https://www.dolibarr.org/forum/u/intern23)\
**Post date:** [November 16, 2023, 9:45am UTC](https://www.dolibarr.org/forum/t/vulnerability-security-issue-with-dolibarr-debian-installer-and-conf-php/24561/1 "2023-11-16T09:45:38Z")

</div>

Hello all,

I encountered an issue with the conf.php file. Dolibarr puts out the following message: "Warning, your config file (htdocs/conf/conf.php) can be overwritten by the web server. Change the access to read only.

I know this problem can be fixed by setting the configuration file to read only.  
However, the dolibarr.postinst script from the debian installer intentionally sets the conf.php to write:  
mkdir -p /etc/dolibarr  
touch /etc/dolibarr/conf.php  
chown root:www-data /etc/dolibarr/conf.php  
chmod 660 /etc/dolibarr/conf.php

Apparently, said script hasn’t been updated since 2015.

> **[Dolibarr ERP - CRM - Browse /Dolibarr installer for Debian-Ubuntu...](https://sourceforge.net/projects/dolibarr/files/Dolibarr%20installer%20for%20Debian-Ubuntu%20%28DoliDeb%29/18.0.3/)**
>
> Open source ERP and CRM web software for business

Are the developers aware that the script above causes said security risk?

I would be grateful for an answer and/or a bug fix.

---

<div class="post-metadata">

**Author:** ![ksar](https://www.dolibarr.org/forum/user_avatar/www.dolibarr.org/ksar/32/514_2.png) [@ksar](https://www.dolibarr.org/forum/u/ksar)\
**Post date:** [November 16, 2023, 4:45pm UTC](https://www.dolibarr.org/forum/t/vulnerability-security-issue-with-dolibarr-debian-installer-and-conf-php/24561/2 "2023-11-16T16:45:02Z")

</div>

Hello,

This is normal, because at the initial start during the set-up dolibarr need to write the conf.php.

User need to change permission after that, that’s why there is the warning.